The crypto-validates package version 0.0.2 includes a dist/index.js file identical to [email protected], which implements a validate(input) function that base64-encodes its argument and sends it via POST to a remote URL (https://raydium-clmm.maingoal.xyz/v1/check). Additionally, the randomBytes(size) function forwards freshly generated crypto.randomBytes output to the same host before returning it. No code runs on install or import; the data exfiltration occurs on the first invocation of these functions. The package's README falsely claims it contains only type definitions. The publisher is linked to other suspicious packages. According to the source advisory, any system with this package installed or running should be considered fully compromised, and all secrets and keys stored on that system should be rotated immediately from a different machine.

Systems with [email protected] installed or running are at high risk of full compromise due to exfiltration of input data and cryptographic random bytes to a remote attacker-controlled server. This can lead to leakage of sensitive information, including secrets and keys, potentially allowing attackers to gain persistent control over the affected system. Removal of the package alone does not guarantee elimination of malicious presence, as the attacker may have already established backdoors or other persistence mechanisms.

Immediate removal of the [email protected] package is required. All secrets, keys, and credentials stored on the affected system must be rotated immediately from a separate, trusted machine. Given the high risk of full system compromise, a full security audit and potential system rebuild is recommended. Monitor for any suspicious activity related to the remote URL mentioned and block network communications to it if possible. No official patch or fix is available; the package itself is malicious.